ODVA’s CIP Security specification has been certified to meet IEC 62443-4-2 requirements at Security Level Capability 3, a development intended to help manufacturers strengthen industrial cybersecurity and simplify product certification.
The certification, awarded by TÜV Rheinland on 22nd October, covers CIP Security, an application-layer security extension for EtherNet/IP industrial networks. It provides mechanisms for authenticating devices and users, controlling access to commands, protecting data integrity and encrypting communications.
IEC 62443-4-2 sets out technical cybersecurity requirements for components used in industrial automation and control systems. Security Level Capability 3 addresses threats from attackers with moderate resources, specialist industrial control system knowledge and moderate motivation, including those using sophisticated methods.
ODVA, the organisation responsible for developing EtherNet/IP and the Common Industrial Protocol (CIP), said the certification would reduce the work required for manufacturers incorporating CIP Security into their products to pursue their own IEC 62443-4-2 certification.
However, certification of the specification does not automatically certify individual products that implement the technology. Manufacturers must still establish that their products meet the relevant requirements.
The development comes as manufacturers face growing pressure to demonstrate that connected industrial products have appropriate cybersecurity protections. The European Union’s Cyber Resilience Act (CRA) introduces cybersecurity requirements for products with digital elements, including many devices used in operational technology environments.
CIP Security provides security functions including authentication, authorisation, data integrity and confidentiality, using technologies including Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). These capabilities can contribute to a product’s security architecture, although using the specification alone does not establish compliance with the CRA.
“Achieving this certification is a significant accomplishment and further strengthens the position of EtherNet/IP as a leading secure industrial network technology,” said Al Beydoun, President and Executive Director of ODVA.
He added that the certification demonstrated the organisation’s commitment to secure industrial communications and supporting the cybersecurity requirements of automation suppliers.
There’s plenty of other editorial on our sister site, Electronic Specifier! Or you can always join in the conversation by commenting below or visiting our LinkedIn page.
